Is CVE-2026-127141 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-127141 being exploited in the wild.

How severe is CVE-2026-127141?

Medium severity, with a CVSS score of 6.5, published 12 November 2026.

Is there a fix for CVE-2026-127141?

Yes: fixed in SOGo 5.12.13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-127141 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-127141?

Check whether you run Alinto Sogo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-127141: SOGo denial of service via IMAP greeting timeout

CVE-2026-127141 · Severity: medium · CVSS 6.5 · Published 2026-11-12

SOGo is a groupware and email server platform used by organizations for collaboration. An authenticated attacker can configure a malicious auxiliary IMAP account that causes SOGo worker processes to hang indefinitely, denying email service to all users for approximately five minutes until workers are forcibly restarted. The attack requires valid account credentials but no user interaction on the victim's part.

Technologies: Alinto Sogo. Vendors: Alinto.

Quick answers

Is CVE-2026-127141 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-127141 being exploited in the wild.
How severe is CVE-2026-127141?: Medium severity, with a CVSS score of 6.5, published 12 November 2026.
Which products and versions are affected?: Alinto Sogo before 5.12.13.
Is there a fix for CVE-2026-127141?: Yes: fixed in SOGo 5.12.13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-127141 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-127141?: Check whether you run Alinto Sogo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: SOGo 5.12.13

Technical details

The vulnerability stems from a missing or ineffective timeout when SOGo connects to auxiliary IMAP accounts during mail view operations. An attacker with valid credentials can point an IMAP account to an attacker-controlled server that accepts TCP connections but never sends an IMAP greeting, causing worker processes to block indefinitely. Concurrent GET requests to that account's mail view occupy all available workers, achieving denial of service until the watchdog process restarts them; the issue is fixed in SOGo 5.12.13.

Affected products

Alinto SOGo before 5.12.13

Timeline

2026-11-12: disclosed
2026-11-04: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.